fix: harden platform form and response boundaries

frontend/platform_admin/src/api/resource-form.ts

@@ -1,17 +1,27 @@
 import type { ResourceField } from './resources';
 
 export type ResourceFormValue = string | number | boolean | undefined;
+export type ResourceFormMode = 'create' | 'edit';
 
 export function isMissingField(value: ResourceFormValue | null): boolean {
   return value === '' || value === null || value === undefined;
 }
 
+export function isResourceFieldRequired(
+  field: ResourceField,
+  mode: ResourceFormMode,
+): boolean {
+  return Boolean(field.required && !(mode === 'edit' && field.type === 'password'));
+}
+
 export function buildResourcePayload(
   fields: ResourceField[],
   form: Record<string, ResourceFormValue>,
+  mode: ResourceFormMode = 'create',
 ): Record<string, unknown> {
   const payload: Record<string, unknown> = {};
   for (const field of fields) {
+    if (mode === 'edit' && field.type === 'password') continue;
     const value = form[field.key];
     if (isMissingField(value)) {
       if (!field.required) continue;
@@ -30,9 +40,19 @@ export function buildResourcePayload(
         payload[field.key] = value === true || value === 'true';
         break;
       case 'json':
-        payload[field.key] =
-          typeof value === 'string' ? JSON.parse(value) : value;
+        if (typeof value !== 'string')
+          throw new Error(`${field.label}必须是有效 JSON`);
+        JSON.parse(value);
+        payload[field.key] = value;
         break;
+      case 'date':
+      case 'datetime': {
+        const date = new Date(String(value));
+        if (Number.isNaN(date.getTime()))
+          throw new Error(`${field.label}必须是有效日期`);
+        payload[field.key] = date.toISOString();
+        break;
+      }
       default:
         payload[field.key] = value;
     }

frontend/platform_admin/src/views/shared/CrudListPage.vue

@@ -32,7 +32,7 @@
 
   <a-drawer :visible="formVisible" :title="editingIdentity ? `编辑${definition.title}` : `新建${definition.title}`" :width="480" @cancel="formVisible = false" @ok="save">
     <a-form :model="form" layout="vertical">
-      <a-form-item v-for="field in definition.fields" :key="field.key" :label="field.label" :required="field.required">
+      <a-form-item v-for="field in formFields" :key="field.key" :label="field.label" :required="isResourceFieldRequired(field, formMode)">
         <a-switch v-if="field.type === 'boolean'" v-model="form[field.key]" />
         <a-input-number v-else-if="field.type === 'number'" v-model="form[field.key]" />
         <a-date-picker v-else-if="field.type === 'date'" v-model="form[field.key]" value-format="YYYY-MM-DD" />
@@ -69,7 +69,11 @@
 import { Message, Modal } from '@arco-design/web-vue';
 import { computed, onMounted, reactive, ref } from 'vue';
 import { resourceApi } from '@/api/resource';
-import { buildResourcePayload, isMissingField } from '@/api/resource-form';
+import {
+  buildResourcePayload,
+  isMissingField,
+  isResourceFieldRequired,
+} from '@/api/resource-form';
 import type { DetailAction, ResourceUiDefinition } from '@/api/resources';
 
 type Row = Record<string, unknown>;
@@ -91,6 +95,14 @@ const actionForm = reactive<Record<string, any>>({});
 const canCreate = computed(() => props.definition.mode !== 'readonly');
 const canEdit = computed(() => props.definition.mode === 'writable');
 const canArchive = computed(() => props.definition.mode === 'writable');
+const formMode = computed<'create' | 'edit'>(() =>
+  editingIdentity.value ? 'edit' : 'create',
+);
+const formFields = computed(() =>
+  props.definition.fields.filter(
+    (field) => formMode.value === 'create' || field.type !== 'password',
+  ),
+);
 const displayFields = computed(() =>
   props.definition.fields.filter((field) => field.key !== 'status'),
 );
@@ -190,15 +202,21 @@ async function submitDetailAction() {
 
 async function save() {
   if (
-    props.definition.fields.some(
-      (field) => field.required && isMissingField(form[field.key]),
+    formFields.value.some(
+      (field) =>
+        isResourceFieldRequired(field, formMode.value) &&
+        isMissingField(form[field.key]),
     )
   ) {
     Message.warning('请填写必填字段');
     return;
   }
   try {
-    const payload = buildResourcePayload(props.definition.fields, form);
+    const payload = buildResourcePayload(
+      props.definition.fields,
+      form,
+      formMode.value,
+    );
     if (editingIdentity.value)
       await resourceApi.update(
         props.definition.resource,